Samba AD management · part of EasySYS

Run your Samba domain from the browser.

EasyDC connects to your Samba Active Directory domain controllers over LDAP and gives you users, groups, computers, DNS, Group Policy and OUs in one web console, with an audit log of every change and a health check for the domain. One binary, and nothing installed on the DC.

Get started Read the docs

Rust core Single binary LDAPS Audit log

admin@mgmt-01 — bash

# Debian / Ubuntu, with the EasySYS repository added $ sudo apt install easydc $ sudo systemctl enable --now easydc # create the admin, then add your DC → http://mgmt-01:3000/setup

Web UI

:3000

The everyday work of a domain, without samba-tool.

Each area reads and writes the directory directly over LDAP. Every change lands in the audit log with the EasyDC user who made it, and failures keep the error the server returned.

/users

Users

Accounts and passwords

Create, edit, enable, disable and delete accounts. Reset a password with must-change-at-next-logon, and unlock an account the moment you see its Locked badge.

Reset passwordUnlock

/groups

Groups

Security and distribution

Create and edit groups of either type, see who is in them, and add or remove members from the group's own page.

Membership

/computers

Computers

Machine accounts

List the computers joined to the domain, disable one that should not authenticate, and delete the accounts of machines that are gone.

Enable / disable

/dns

DNS

AD-integrated zones

Browse the zones stored in the domain's DNS partition and add or delete records, written in the format Samba actually serves.

A · AAAACNAME · MXTXT · NS · PTR

/gpo

Group Policy

GPOs and their links

Create Group Policy Objects, set their status, and link or unlink them to OUs. Policy settings stay in SYSVOL on the DC.

Link to OU

/ous

Organizational Units

The OU tree

Browse the tree, create, rename and delete OUs, and move users, groups and computers into the OU where they belong.

Move objects

Health check

Find what is quietly broken before it breaks logons.

One click runs thirteen read-only checks against the domain and reports each as passed, warning, failed or skipped, with what to do about it. Everything runs over LDAP, and nothing is written.

Time

Clock skew against the DC, warning at 60 s and failing at the 300 s Kerberos limit

Domain

Domain controllers and sites
All five FSMO holders still exist
Domain and forest functional levels

Replication

Inbound partners on the domain, configuration and schema partitions

DNS

The _ldap, _kerberos, _kpasswd and _gc SRV records clients use to find a DC
Each DC's host record and _msdcs alias

Security

LDAPS reachability and certificate expiry
Machine account quota and anonymous LDAP access
Unconstrained delegation, and disabled accounts in privileged groups

Hygiene

Computers with no logon for 90 days
Accounts whose password is not required, or never expires

Some things are only visible from a shell on the DC, such as samba-tool dbcheck and SYSVOL replication; the health check guide lists what is and is not covered.

Architecture

A console beside your domain, not a change to it

EasyDC is a web console and an LDAP client in one binary. It binds to each domain controller as the account you give it and works on the directory directly, so there is no agent to install and nothing to change on the DCs.

EasySYS service Your existing infrastructure Add as many domain controllers as you like; each keeps its own bind account.

Deploy

Running in minutes. Upgraded like everything else.

EasyDC installs from the signed EasySYS package repository, starts on boot under systemd, and upgrades through the package manager you already use. Already running it by hand? The package moves it over for you. The installation guide has the details.

1

Add the signed repository

apt, dnf and zypper channels for x86_64 and arm64, signed with the same key as the other EasySYS products.

2

Install and enable the service

It runs as its own user, listens on port 3000 and keeps its state in one SQLite file.

3

Create your admin, add a DC

Point it at a domain controller with an ldaps:// URL and a bind account.

Debian / Ubuntu RHEL / Fedora openSUSE / SLES Air-gapped

# 1 — trust the repository $ curl -fsSL https://repo.easysys.io/easydc/stable/debian/key.gpg \ | sudo gpg --dearmor -o /usr/share/keyrings/easysys.gpg $ echo "deb [signed-by=/usr/share/keyrings/easysys.gpg] \ https://repo.easysys.io/easydc/stable/debian ./" \ | sudo tee /etc/apt/sources.list.d/easydc.list # 2 — install and start $ sudo apt update && sudo apt install easydc $ sudo systemctl enable --now easydc # 3 — create your admin → http://<host>:3000/

# 1 — trust the repository $ sudo tee /etc/yum.repos.d/easydc.repo >/dev/null <<'EOF' [easydc] name=EasyDC baseurl=https://repo.easysys.io/easydc/stable/redhat enabled=1 gpgcheck=1 gpgkey=https://repo.easysys.io/easydc/stable/redhat/key.gpg EOF # 2 — install and start $ sudo dnf install easydc $ sudo systemctl enable --now easydc # 3 — create your admin → http://<host>:3000/

# 1 — trust the repository $ sudo zypper addrepo -fg \ https://repo.easysys.io/easydc/stable/redhat easydc # 2 — install and start $ sudo zypper install easydc $ sudo systemctl enable --now easydc # 3 — create your admin → http://<host>:3000/

# 1 — download the package for your architecture # github.com/easysysio/EasyDC/releases # 2 — install and start $ sudo dpkg -i easydc_*_amd64.deb # or _arm64.deb $ sudo rpm -i easydc-*.x86_64.rpm # or .aarch64.rpm $ sudo systemctl enable --now easydc # 3 — create your admin → http://<host>:3000/

Start with one domain controller.

Add a single DC, run the health check, and see what your domain looks like from the browser. MIT licensed and developed in the open.

Read the docs GitHub